theevilbit blog theevilbit.github.io

Divide and Conquer - A technique to bypass NextGen AV

theevilbit.github.io·278w

CVE-2020-9771 - Reversing Engineering the Fix

theevilbit.github.io·283w

NOCVE - Microsoft Teams for macOS Local Privilege Escalation

theevilbit.github.io·287w

Let's talk macOS Authorization

theevilbit.github.io·291w

CVE-2020-9771 - mount_apfs TCC bypass and privilege escalation

theevilbit.github.io·306w

CVE-2020-14977 - Secure coding XPC Services - Part 5 - PID reuse attacks

theevilbit.github.io·309w

CVE-2020-14978 - Secure coding XPC Services - Part 4 - Improved client authorization

theevilbit.github.io·309w

The AMFI MACF policy system call

theevilbit.github.io·310w

CVE-2020-0984 - Secure coding XPC Services - Part 3 - Incorrect client verification

theevilbit.github.io·311w

Kernel Debugging macOS with SIP

theevilbit.github.io·314w

Secure coding XPC Services - Part 2 - Checking CS (CodeSigning) flags of the client

theevilbit.github.io·321w

TALK - Exploiting directory permissions on macOS

theevilbit.github.io·322w

CVE-2019-20057 - Secure coding XPC services - Part 1 - Why EvenBetterAuthorization is not enough?

theevilbit.github.io·331w

GateKeeper - Bypass or not bypass?

theevilbit.github.io·342w

CVE-2020-14974 & CVE-2020-14975 - IOBit Unlocker 1.1.2 - Local Privilege Escalation

theevilbit.github.io·344w

NOCVE - Few click RCE via GitHub Desktop macOS client with Gatekeeper bypass and custom URL handlers

theevilbit.github.io·345w

Shield - An app to protect against process injection on macOS

theevilbit.github.io·347w

UninstallString - a possible LPE via Social Engineering

theevilbit.github.io·353w

A simple protection against HMValidateHandle technique

theevilbit.github.io·355w

DYLD_INSERT_LIBRARIES DYLIB injection in macOS / OSX

theevilbit.github.io·358w

Log in to enable infinite scrolling